CVE-2026-22043 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
A flawed IAM short-circuit in RustFS allows restricted service accounts to self-issue unrestricted credentials, enabling privilege escalation and policy bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22043?
CVE-2026-22043 is a medium-severity vulnerability in rustfs, published on 8 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.
Which versions are affected by CVE-2026-22043?
2 open source packages ship an affected version, including rustfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rustfs crates.io | From 1.0.0-alpha.13 | 1.0.0-alpha.79 |
rustfs crates.io | From 1.0.0-alpha.13 | 1.0.0-alpha.79 |
Products include Rustfs Rustfs.
How do I fix CVE-2026-22043?
Upgrade rustfs to 1.0.0-alpha.79 or later.
Is CVE-2026-22043 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22043 exists.
Other vulnerabilities in rustfs
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2025-68705 RustFS Path Traversal Vulnerability
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
Sources
Also known as GHSA-xgr5-qc6w-vcg9.